Implement API Management

Implement API Management

API Management (APIM) Overview:

API Management (APIM) helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services. Businesses everywhere are seeking to extend their operations as a digital platform, creating new channels, finding new customers, and driving deeper engagement with existing ones. API Management provides the core competencies to ensure a successful API program through developer engagement, business insights, analytics, security, and protection. You can use Azure API Management to take any backend and launch a full-fledged API program based on it.

Terminology

Implement API Management

Creating an API Management instance

To use API Management, administrators create APIs. Each API consists of one or more operations, and each API can be added to one or more products. To use an API, developers subscribe to a product that contains that API, and then they can call the API’s operation, subject to any usage policies that might be in effect. 

Manage using Git

Each API Management service instance maintains a configuration database that contains information about the configuration and metadata for the service instance. You can make changes to the service instance by changing a setting in the Azure portal, by using a PowerShell cmdlet, or by making a REST API call. In addition to these methods, you can also manage your service instance configuration by using Git.

When you make changes to your service by using the Azure portal, PowerShell cmdlets, or the REST API, you are managing your service configuration database by using the https://{name}.management.azure-api.net endpoint. This is depicted in the diagram on the slide. The diagram also depicts how you can manage your service configuration by using Git and the Git repository for your service, which is located at https://{name}.scm.azure-api.net.

Service hierarchy

Create and manage APIs

Each API contains one or more sets of operations

Operations are configurable, granting control over:

• URL mapping
• Query and path parameters
• Request and response content
• Operation response caching

Implement API Management

Subscriptions

When you publish APIs through API Management, it’s easy and common to secure access to those APIs by using subscription keys. Developers who need to consume the published APIs must include a valid subscription key in HTTP requests when they make calls to those APIs. Otherwise, the calls are rejected immediately by the API Management gateway. They aren’t forwarded to the back-end services.

To get a subscription key for accessing APIs, a subscription is required. A subscription is essentially a named container for a pair of subscription keys. Developers who need to consume the published APIs can get subscriptions. And they don’t need approval from API publishers. API publishers can also create subscriptions directly for API consumers.

Traditionally, subscriptions in API Management were always associated with a single API product scope. Developers found the list of products on the Developer portal. Then they’d submit subscription requests for the products they wanted to use. After a subscription request is approved, either automatically or by API publishers, the developer can use the keys in it to access all APIs in the product.

Client certificates

API Management provides the capability to secure access to APIs (that is, client to API Management) by using client certificates. Currently, you can check the thumbprint of a client certificate against a desired value. You can also check the thumbprint against existing certificates uploaded to API Management.

Checking the expiration date

Policies can be configured to check if the certificate is expired.

Checking the issuer and subject

Policies can be configured to check the issuer and subject of a client certificate.

API Management provides the capability to secure access to APIs (that is, client to API Management) by using client certificates. Currently, you can check the thumbprint of a client certificate against a desired value. You can also check the thumbprint against existing certificates uploaded to API Management.

Checking the thumbprint

Policies can be configured to check the thumbprint of a client certificate.

Checking a thumbprint against certificates uploaded to API Management

Policies can be configured to check the thumbprint of a client certificate against certificates uploaded to API Management.

Implement API Management

Policies

In Azure API Management (APIM), policies are a powerful capability of the system that allow the publisher to change the behavior of the API through configuration. Policies are a collection of Statements that are executed sequentially on the request or response of an API. Popular Statements include format conversion from XML to JSON and call rate limiting to restrict the amount of incoming calls from a developer. Many more policies are available out of the box.

Editing policies

The policy definition is an XML document that describes a sequence of inbound and outbound statements. The XML can be edited directly in the definition window. You can also select a predefined policy from the list that is provided to the right of the policy window. The statements applicable to the current scope are enabled and highlighted. Selecting an enabled statement adds the appropriate XML at the location of the cursor in the definition view.

Policy scopes

If you have a policy at the global level and a policy configured for an API, then whenever that particular API is used both policies will be applied. API Management allows for deterministic ordering of combined policy statements using a special <base /> element.

Implement IaaS solutions

Create Azure App Service Web Apps

Implement Azure functions

Develop solutions that use Cosmos DB storage

Develop solutions that use blob storage

Implement user authentication and authorization

Implement secure cloud solutions

Integrate caching and content delivery within solutions

Instrument solutions to support monitoring and logging